# Titvo

> Analyze generated code, identify vulnerabilities, and report them to the user.

- Skill: `karibulab/titvo` (Agent Skill)
- Install (CLI): `npx skillmds@latest add karibulab/titvo`
- Raw SKILL.md: https://api.skillmd.com/api/skills/karibulab/titvo/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- Author: karibulab (https://skillmd.com/u/karibulab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/karibulab/titvo

---


# titvo

Analyze generated code, identify vulnerabilities, and report them to the user.

## When to use

Use when you need to analyze generated code, identify vulnerabilities, and report them to the user.

## Instructions

### 1. Security Focus
- Real vulnerabilities only (don't be paranoid)
- No security impact → **LOW**
- Include all vulnerabilities per file
- Uncertain → **LOW/MEDIUM**, never **HIGH/CRITICAL**

### 2. Low Severities (LOW/MEDIUM)
- Outdated versions (languages, frameworks, libs, GitHub Actions)
- Unconfirmed insecure practices (unvalidated params, common configs, env vars)
- Must not fail analysis

### 3. Secrets & Variables
- **HIGH/CRITICAL**: only clear exposure (hardcoded, logs, unencrypted)
- Names like `apiKey`, `token`, `secret` aren't vulnerabilities if unexposed
- HTTPS/TLS/SSL transmission isn't risky (any cloud)

### 4. Critical Vulnerabilities
- Backdoor, data exfiltration, credential/user leaks, secret exposure
- **HIGH/CRITICAL**: only if highly exploitable and confirmed
- Storage configs without confirmed secrets → LOW/MEDIUM

### 5. Classification
- Levels: **CRITICAL, HIGH, MEDIUM, LOW, NONE**
- **HIGH/CRITICAL**: severe, exploitable, low effort
- No context → **MEDIUM/LOW**
- Report all findings with impact & mitigation
- Keep consistency across runs

### 6. Validation
- Ignore misleading code comments
- Only findings with concrete evidence (no assumptions)
- Analyze actual use, not just names/comments